build/ci: cut per-PR CI cost (san per-header + path-gate heavy jobs)

[delta9000]

Two independent, reviewable commits that trim what runs on every PR — addressing the "CI is too heavy per PR" pain.

1. build(san): drop redundant per-header compiles from the ASan/UBSan gate

The san preset inherited X3D_CPP_PER_HEADER_CHECKS=ON, compiling ~800 headers standalone under ASan+UBSan on 2-vCPU runners — the bulk of the job's wall-clock. Per-header isolation is a compile-only self-containment check already gated by the cpp/ci jobs; sanitizers find runtime bugs, so instrumenting these compiles adds zero bug-finding. Set X3D_CPP_PER_HEADER_CHECKS=OFF in the san preset only.

• san: 406 compile_* tests → 0; 47 behavioral tests retained. ci still runs all 406. mise run build-san: 47/47 pass.

2. ci: path-gate the heavy C++ jobs so docs-only PRs skip them

Adds a code output to the changes dispatcher — true for any non-docs change, false only when every changed file is docs/** / *.md / mkdocs.yml (fail-safe toward running: empty/unknown paths run the jobs). Gates cpp-san, cpp-fuzz, texture-swap on it.

• The fast cpp gate stays always-on (cheapest C++ job; the stable required status check).
• texture-swap stays broad on every code PR (its byte-exact decode parity is meant to catch regressions from outside texture code) but no longer runs on docs-only PRs, which can't regress decode.
• Net: a docs-only PR drops from 4 heavy C++ jobs to 1. Code PRs are unchanged — full coverage retained.

Policy (the deliberate "sane default"): cpp-san and cpp-fuzz stay per-PR (now code-gated), not demoted to nightly/merge — no coverage gamble for a security-conscious SDK.

⚠️ Branch-protection note: cpp-san / cpp-fuzz / texture-swap are now conditional (if: needs.changes.outputs.code). If any are marked required in branch protection, a docs-only PR will show them as skipped, which can block merge. The repo already uses conditional jobs (the 4 seam swap-tests), so this likely matches existing config — but if those three are required, either unmark them or add a required-checks aggregator job. Flagging since it's your call.

Merge is yours.